Extracted

• • Target

    c0a450f06575f4a463c486c8cdf69775_JaffaCakes118

  • Size

    434KB

  • MD5

    c0a450f06575f4a463c486c8cdf69775

  • SHA1

    7d8c6bf41f812c22bc4813a2a26b65c812d9add6

  • SHA256

    884f371bc0234626363d1ae84089fe785e86e5748334a0cb53902c5791eb272d

  • SHA512

    d4ae65557644f27f1544547f43c58b81f4498ab1e4d95cb0a95b2d810699c495e2091623422635f32d4d4965a4b6d336e33a19306aeb262aeeb3fba407551894

  • SSDEEP

    12288:+AcEXkELYWiTVxqvf1PgYHh71Nmylhyl:BBXkYH4xqvf1PjB71Eylhyl

  Score

  10^/10

  latentbotdiscoveryevasionpersistencetrojan

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies firewall policy service

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2